Package net.shibboleth.oidc.profile.oauth2.config.impl

Class AbstractOAuth2ClientAuthenticableProfileConfiguration

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.profile.config.AbstractProfileConfiguration

net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

Direct Known Subclasses:

AbstractOAuth2FlowAwareProfileConfiguration, AbstractOAuth2TokenValidatingConfiguration

public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
extends AbstractConditionalProfileConfiguration
implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration

Base class for OAuth profile configurations that support OAuth-defined client authentication methods.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Set<String>>	authenticationFlowsLookupStrategy	Lookup function to supply authentication flows.
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Validation of JWT claims for subset of client auth methods.
private Function<ProfileRequestContext,ClientSecretCredential>	clientCredentialLookupStrategy	Lookup function to retrieve a client credential from the given profile request context.
private Function<ProfileRequestContext,String>	clientIdLookupStrategy	Lookup function to retrieve the client_id from the given profile request context.
private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>	defaultAuthenticationContextsLookupStrategy	Lookup function to supply default authentication methods.
private Predicate<ProfileRequestContext>	forceAuthnPredicate	Whether to mandate forced authentication for the request.
private Function<ProfileRequestContext,Collection<String>>	postAuthenticationFlowsLookupStrategy	Lookup function to supply post authentication flows.
private Function<ProfileRequestContext,Integer>	proxyCountLookupStrategy	Lookup function to supply proxyCount property.
private Function<ProfileRequestContext,String>	tokenEndpointAuthMethodLookupStrategy	The token endpoint authentication method to use with an upstream OpenID Provider.
private Function<ProfileRequestContext,Set<String>>	tokenEndpointAuthMethodsLookupStrategy	Enabled token endpoint authentication methods.

Fields inherited from class net.shibboleth.idp.profile.config.AbstractProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractOAuth2ClientAuthenticableProfileConfiguration(String profileId)	Constructor.

Method Summary

Modifier and Type	Method	Description
Set<String>	getAuthenticationFlows(ProfileRequestContext profileRequestContext)
ClaimsValidator	getClaimsValidator(ProfileRequestContext profileRequestContext)	Get the ClaimsValidator to apply to JWT-based client authentication.
ClientSecretCredential	getClientCredential(ProfileRequestContext profileRequestContext)	Get the client credential for the given context.
String	getClientId(ProfileRequestContext profileRequestContext)	Get the client_id appropriate for the given context.
List<Principal>	getDefaultAuthenticationMethods(ProfileRequestContext profileRequestContext)
List<String>	getPostAuthenticationFlows(ProfileRequestContext profileRequestContext)
Integer	getProxyCount(ProfileRequestContext profileRequestContext)
String	getTokenEndpointAuthMethod(ProfileRequestContext profileRequestContext)	Get the token endpoint authentication method to use with an OpenID Provider.
Set<String>	getTokenEndpointAuthMethods(ProfileRequestContext profileRequestContext)	Get the enabled token endpoint authentication methods.
boolean	isForceAuthn(ProfileRequestContext profileRequestContext)
void	setAuthenticationFlows(Collection<String> flows)	Set the authentication flows to use.
void	setAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the authentication flows to use.
void	setClaimsValidator(ClaimsValidator validator)	Set the ClaimsValidator to apply to JWT-based client authentication.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.
void	setClientCredential(ClientSecretCredential clientCredential)	Set a fixed client credential to use no matter what the context/request.
void	setClientCredentialLookupStrategy(Function<ProfileRequestContext,ClientSecretCredential> strategy)	Set the client credential lookup strategy.
void	setClientId(String clientId)	Set a fixed client_id to use no matter what the context/request.
void	setClientIdLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy to locate a client_id.
void	setDefaultAuthenticationMethods(Collection<AuthenticationContextClassReferencePrincipal> contexts)	Set the default authentication contexts to use, expressed as custom principals.
void	setDefaultAuthenticationMethodsLookupStrategy(Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>> strategy)	Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
void	setForceAuthn(boolean flag)	Set whether a fresh user presence proof should be required for this request.
void	setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether a fresh user presence proof should be required for this request.
void	setPostAuthenticationFlows(Collection<String> flows)	Set the ordered collection of post-authentication interceptor flows to enable.
void	setPostAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the post-authentication interceptor flows to enable.
void	setProxyCount(Integer count)	Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setTokenEndpointAuthMethod(String method)	Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethodLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethods(Collection<String> methods)	Set the enabled token endpoint authentication methods.
void	setTokenEndpointAuthMethodsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the enabled token endpoint authentication methods.

Methods inherited from class net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.idp.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getInboundInterceptorFlows, getOutboundInterceptorFlows, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setInboundFlowsLookupStrategy, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

doInitialize, getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

isLocal

Methods inherited from interface net.shibboleth.idp.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.ProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, getSecurityConfiguration

Field Detail

tokenEndpointAuthMethodsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy

Enabled token endpoint authentication methods.

tokenEndpointAuthMethodLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> tokenEndpointAuthMethodLookupStrategy

The token endpoint authentication method to use with an upstream OpenID Provider.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Validation of JWT claims for subset of client auth methods.

forceAuthnPredicate

@Nonnull
private Predicate<ProfileRequestContext> forceAuthnPredicate

Whether to mandate forced authentication for the request.

proxyCountLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy

Lookup function to supply proxyCount property.

defaultAuthenticationContextsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>> defaultAuthenticationContextsLookupStrategy

Lookup function to supply default authentication methods.

authenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy

Lookup function to supply authentication flows.

postAuthenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy

Lookup function to supply post authentication flows.

clientCredentialLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClientSecretCredential> clientCredentialLookupStrategy

Lookup function to retrieve a client credential from the given profile request context.

clientIdLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> clientIdLookupStrategy

Lookup function to retrieve the client_id from the given profile request context.

Constructor Detail

AbstractOAuth2ClientAuthenticableProfileConfiguration

protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty
                                                                String profileId)

Constructor.

Parameters:

profileId - Unique profile identifier

Method Detail

getTokenEndpointAuthMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getTokenEndpointAuthMethods(@Nullable
                                               ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2ClientAuthenticableProfileConfiguration

Get the enabled token endpoint authentication methods.

Specified by:

getTokenEndpointAuthMethods in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

enabled token endpoint authentication methods

setTokenEndpointAuthMethods

public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements
                                        Collection<String> methods)

Set the enabled token endpoint authentication methods.

Parameters:

methods - What to set.

setTokenEndpointAuthMethodsLookupStrategy

public void setTokenEndpointAuthMethodsLookupStrategy(@Nonnull
                                                      Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the enabled token endpoint authentication methods.

Parameters:

strategy - lookup strategy

getTokenEndpointAuthMethod

@Nonnull
public String getTokenEndpointAuthMethod(@Nullable
                                         ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2ClientAuthenticableClientProfileConfiguration

Get the token endpoint authentication method to use with an OpenID Provider.

Specified by:

getTokenEndpointAuthMethod in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the token endpoint authentication method to use.

setTokenEndpointAuthMethod

public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements
                                       String method)

Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

method - the token endpoint authentication method to set.

Since:

2.2.0

setTokenEndpointAuthMethodLookupStrategy

public void setTokenEndpointAuthMethodLookupStrategy(@Nonnull
                                                     Function<ProfileRequestContext,String> strategy)

Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

strategy - lookup strategy

Since:

2.2.0

getClaimsValidator

@Nullable
public ClaimsValidator getClaimsValidator(@Nullable
                                          ProfileRequestContext profileRequestContext)

Get the ClaimsValidator to apply to JWT-based client authentication.

Specified by:

getClaimsValidator in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the validator to use

Since:

3.1.0

setClaimsValidator

public void setClaimsValidator(@Nullable
                               ClaimsValidator validator)

Set the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

validator - validator to use

Since:

3.1.0

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
                                             Function<ProfileRequestContext,ClaimsValidator> strategy)

Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

strategy - lookup strategy

Since:

3.1.0

isForceAuthn

public boolean isForceAuthn(@Nullable
                            ProfileRequestContext profileRequestContext)

Specified by:

isForceAuthn in interface AuthenticationProfileConfiguration

setForceAuthn

public void setForceAuthn(boolean flag)

Set whether a fresh user presence proof should be required for this request.

Parameters:

flag - flag to set

setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull
                                   Predicate<ProfileRequestContext> condition)

Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:

condition - condition to set

getProxyCount

@Nullable
public Integer getProxyCount(@Nullable
                             ProfileRequestContext profileRequestContext)

Specified by:

getProxyCount in interface AuthenticationProfileConfiguration

setProxyCount

public void setProxyCount(@Nullable @NonNegative
                          Integer count)

Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

count - proxy count

setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull
                                        Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

strategy - lookup strategy

getAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getAuthenticationFlows(@Nullable
                                          ProfileRequestContext profileRequestContext)

Specified by:

getAuthenticationFlows in interface AuthenticationProfileConfiguration

setAuthenticationFlows

public void setAuthenticationFlows(@Nullable @NonnullElements
                                   Collection<String> flows)

Set the authentication flows to use.

Parameters:

flows - flow identifiers to use

setAuthenticationFlowsLookupStrategy

public void setAuthenticationFlowsLookupStrategy(@Nonnull
                                                 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the authentication flows to use.

Parameters:

strategy - lookup strategy

getPostAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getPostAuthenticationFlows(@Nullable
                                               ProfileRequestContext profileRequestContext)

Specified by:

getPostAuthenticationFlows in interface AuthenticationProfileConfiguration

setPostAuthenticationFlows

public void setPostAuthenticationFlows(@Nullable @NonnullElements
                                       Collection<String> flows)

Set the ordered collection of post-authentication interceptor flows to enable.

Parameters:

flows - flow identifiers to enable

setPostAuthenticationFlowsLookupStrategy

public void setPostAuthenticationFlowsLookupStrategy(@Nonnull
                                                     Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the post-authentication interceptor flows to enable.

Parameters:

strategy - lookup strategy

getDefaultAuthenticationMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<Principal> getDefaultAuthenticationMethods(@Nullable
                                                       ProfileRequestContext profileRequestContext)

Specified by:

getDefaultAuthenticationMethods in interface AuthenticationProfileConfiguration

setDefaultAuthenticationMethods

public void setDefaultAuthenticationMethods(@Nullable @NonnullElements
                                            Collection<AuthenticationContextClassReferencePrincipal> contexts)

Set the default authentication contexts to use, expressed as custom principals.

Parameters:

contexts - default authentication contexts to use

setDefaultAuthenticationMethodsLookupStrategy

public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull
                                                          Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>> strategy)

Set a lookup strategy for the authentication contexts to use, expressed as custom principals.

Parameters:

strategy - lookup strategy

setClientCredentialLookupStrategy

public void setClientCredentialLookupStrategy(@Nonnull
                                              Function<ProfileRequestContext,ClientSecretCredential> strategy)

Set the client credential lookup strategy.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientCredential

public void setClientCredential(@Nullable
                                ClientSecretCredential clientCredential)

Set a fixed client credential to use no matter what the context/request.

Parameters:

clientCredential - the static client credential to use

Since:

2.2.0

getClientCredential

public ClientSecretCredential getClientCredential(@Nullable
                                                  ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2ClientAuthenticableClientProfileConfiguration

Get the client credential for the given context. Typically a client_secret associated with the current client_id.

Specified by:

getClientCredential in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client credential

setClientIdLookupStrategy

public void setClientIdLookupStrategy(@Nonnull
                                      Function<ProfileRequestContext,String> strategy)

Set the strategy to locate a client_id.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientId

public void setClientId(@Nullable
                        String clientId)

Set a fixed client_id to use no matter what the context/request.

Parameters:

clientId - the static clientId to use

Since:

2.2.0

getClientId

@Nullable
public String getClientId(@Nullable
                          ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2ClientAuthenticableClientProfileConfiguration

Get the client_id appropriate for the given context. Typically that associated with the chosen OpenID Connect Provider.

Specified by:

getClientId in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client_id